Apple Releases Security Updates to Fix WebKit Bug in iOS 26, iPadOS 26, and macOS Tahoe

Apple has released its first Background Security Improvements (BSI) updates across iOS 26.3.1, iPadOS 26.3.1, and macOS Tahoe 26.3.1, introducing a new mechanism for delivering urgent security fixes outside standard software updates. The release addresses a WebKit vulnerability that could allow malicious web content to bypass the Same Origin Policy, a core browser security safeguard.

New Update System Replaces Rapid Security Responses

Background Security Improvements replace Apple’s earlier Rapid Security Responses, marking a shift in how the company delivers critical patches. The new system was introduced with iOS 26, iPadOS 26, and macOS Tahoe, and was tested in version 26.3 updates before its public rollout.

BSIs are designed to deliver security fixes more quickly, specifically targeting components like Safari, WebKit, and other system libraries without requiring a full OS update.

WebKit Vulnerability Patched With Input Validation Fix

The first BSI release fixes a WebKit vulnerability that could allow specially crafted web content to bypass Same Origin Policy restrictions. This policy is a foundational web security measure that prevents scripts from one site from accessing data on another.

Apple states the issue has been resolved through improved input validation, reducing the risk of cross-origin attacks.

Installation, Compatibility, And Rollback Details

Users can install Background Security Improvements through the Privacy and Security section in system settings, either manually or automatically if the relevant toggle is enabled. If users choose not to install BSIs, the same fixes will be included later in standard software updates.

Apple notes that BSIs may cause compatibility issues in rare cases. These updates can be temporarily removed, allowing Apple to refine and reissue them in subsequent releases. Apple has also issued a macOS Tahoe 26.3.2 BSI update specifically for the MacBook Neo.